On 22 October 2026, Net Protections Holdings announced that unauthorized access by a third party had been detected in the NP Atobarai invoice reissuance system, and that the names and addresses in 28,884 transaction records had been viewed. While the NP Atobarai payment service itself continues to operate normally, the invoice reissuance system is scheduled to resume after safety checks are completed.
Net Protections Holdings announced on 22 October 2026 that unauthorized access by a third party had occurred in the NP Atobarai invoice reissuance system. The affected data covers 28,884 transaction records and includes names and addresses. For corporate users, company and department names were also affected.
The unauthorized activity involved mechanically and continuously sending suspicious requests identified on 14 October, and access to some personal information was confirmed. The specific attack method has not been determined in the announcement, and no conclusion has been reached that a specific method such as IDOR was the cause.
The information affected varied by transaction type. For general transactions, it comprised names and addresses. For corporate users, it additionally included company and department names, while for undelivered invoices it also included the fact that the invoice had not been received. The announcement did not identify any compromise of credit card numbers or bank account information.
The NP Atobarai payment service itself continues to operate normally, while the invoice reissuance system is scheduled to resume after security measures are completed. The incident has been reported to the Personal Information Protection Commission and JIPDEC, and individual notifications are expected to be sent to affected parties.